pdurlej/platform

Fork 0

fix(platformctl): bind apply actor identity #676

Merged

pdurlej merged 1 commit from codex/190-apply-actor-binding into main

2026-06-01 19:00:26 +02:00

codex commented

2026-06-01 17:25:20 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Summary

Binds platformctl apply approval verification to an apply actor identity in addition to the approved PR/SHA.

Canary Context Pack

Product story

Runtime apply should not be green only because a merged PR SHA matches. The apply path should also record and check who is invoking the mutation lane so audit evidence can distinguish operator-approved runtime apply from ambiguous automation.

What changed

Added PLATFORMCTL_APPLY_ACTOR / compatible actor env lookup for apply approval verification.
Added default allowed apply actors plus PLATFORMCTL_APPLY_ALLOWED_ACTORS override.
Rejects approved PRs when no safe actor identity is present or when the actor is not allowed.
Records apply actor, PR author, merged-by, and allowed actors in apply results and status artifacts.
Adds PLATFORMCTL_APPLY_ACTOR: ${{ github.actor }} and apply_actor fields to the Forgejo apply workflow audit JSONL.
Adds regression tests for missing actor, actor mismatch, configured actor allowance, status artifact fields, and workflow contract.

Why it changed

Closes the #190 audit-hygiene gap: approval was bound to PR/SHA, but not to the actor running apply.

Files touched

control-plane/platformctl/apply.py
control-plane/forgejo-actions/apply.yaml
control-plane/platformctl/tests/test_apply_phase3.py
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py

Relevant context

Issue #190
M06 apply-pipeline hardening lane
Claude guardrail: security-sensitive apply work stays small and non-runtime

Runtime evidence

No runtime apply was run. This is code and CI contract only.

Known constraints

The CLI file is intentionally untouched because it has unrelated local dirty changes.
Actor capture is env-based in this slice. The Forgejo workflow now sets the env explicitly.
Default allowed actors are owner/operator aliases plus the PR merged_by actor when present.

Explicit out-of-scope

No runtime apply.
No production restart.
No broad approval redesign.
No issue/comment mutation.

Requested decision

Review and merge if checks stay green.

Merge blockers

Actor mismatch should fail closed.
Status artifacts and audit logs must not include secrets.
Workflow must continue to use PLATFORMCTL_FORGEJO_TOKEN, not broader tokens.

Spec sources read

control-plane/platformctl/apply.py - apply approval verification and status artifact behavior.
control-plane/forgejo-actions/apply.yaml - Forgejo apply workflow actor/audit contract.
control-plane/platformctl/tests/test_apply_phase3.py - apply verification and status artifact tests.
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py - workflow structural contract tests.

Validation

UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_apply_phase3.py platformctl/tests/test_apply_env_file.py platformctl/tests/test_pr_sanity.py platformctl/tests/test_forgejo_ci_scripts_contract.py platformctl/tests/test_health_phase3.py - 211 passed
PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json - exitCode 0

Closes #190

Canary status: missing - fire canary 3+3 manually before merge ## Summary Binds `platformctl apply` approval verification to an apply actor identity in addition to the approved PR/SHA. ## Canary Context Pack ### Product story Runtime apply should not be green only because a merged PR SHA matches. The apply path should also record and check who is invoking the mutation lane so audit evidence can distinguish operator-approved runtime apply from ambiguous automation. ### What changed - Added `PLATFORMCTL_APPLY_ACTOR` / compatible actor env lookup for apply approval verification. - Added default allowed apply actors plus `PLATFORMCTL_APPLY_ALLOWED_ACTORS` override. - Rejects approved PRs when no safe actor identity is present or when the actor is not allowed. - Records apply actor, PR author, merged-by, and allowed actors in apply results and status artifacts. - Adds `PLATFORMCTL_APPLY_ACTOR: ${{ github.actor }}` and `apply_actor` fields to the Forgejo apply workflow audit JSONL. - Adds regression tests for missing actor, actor mismatch, configured actor allowance, status artifact fields, and workflow contract. ### Why it changed Closes the #190 audit-hygiene gap: approval was bound to PR/SHA, but not to the actor running apply. ### Files touched - `control-plane/platformctl/apply.py` - `control-plane/forgejo-actions/apply.yaml` - `control-plane/platformctl/tests/test_apply_phase3.py` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` ### Relevant context - Issue #190 - M06 apply-pipeline hardening lane - Claude guardrail: security-sensitive apply work stays small and non-runtime ### Runtime evidence No runtime apply was run. This is code and CI contract only. ### Known constraints - The CLI file is intentionally untouched because it has unrelated local dirty changes. - Actor capture is env-based in this slice. The Forgejo workflow now sets the env explicitly. - Default allowed actors are owner/operator aliases plus the PR `merged_by` actor when present. ### Explicit out-of-scope - No runtime apply. - No production restart. - No broad approval redesign. - No issue/comment mutation. ### Requested decision Review and merge if checks stay green. ### Merge blockers - Actor mismatch should fail closed. - Status artifacts and audit logs must not include secrets. - Workflow must continue to use `PLATFORMCTL_FORGEJO_TOKEN`, not broader tokens. ## Spec sources read - `control-plane/platformctl/apply.py` - apply approval verification and status artifact behavior. - `control-plane/forgejo-actions/apply.yaml` - Forgejo apply workflow actor/audit contract. - `control-plane/platformctl/tests/test_apply_phase3.py` - apply verification and status artifact tests. - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - workflow structural contract tests. ## Validation - `UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_apply_phase3.py platformctl/tests/test_apply_env_file.py platformctl/tests/test_pr_sanity.py platformctl/tests/test_forgejo_ci_scripts_contract.py platformctl/tests/test_health_phase3.py` - 211 passed - `PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json` - exitCode 0 Closes #190

codex added this to the 06 - Agent execution and CI governance milestone

2026-06-01 17:25:20 +02:00

codex added the

risk/process

class/security-sensitive

tier/full

agent/codex

labels

2026-06-01 17:25:20 +02:00

codex added 1 commit

2026-06-01 17:25:20 +02:00

fix(platformctl): bind apply actor identity

canary-required / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 35s

Details

python-ci / Python 3.12 (pull_request) Successful in 36s

Details

python-ci / Python 3.13 (pull_request) Successful in 37s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

canary-required / canary (pull_request) Successful in 12s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 3m48s

Details

d635d5874c

codex commented

2026-06-01 17:32:52 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 676
Commit: d635d5874c67df2c7515ea9ae28afad9fe64b916
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — control-plane/platformctl/apply.py
- Evidence: control-plane/platformctl/apply.py
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
low Hardcoded default allowed actors are deployment-specific
- Evidence: control-plane/platformctl/apply.py line 50: DEFAULT_APPLY_ALLOWED_ACTORS = ("pdurlej", "pd", "Piotr") — these are personal usernames, not role-based identifiers
- Next: Consider documenting that DEFAULT_APPLY_ALLOWED_ACTORS must be overridden via PLATFORMCTL_APPLY_ALLOWED_ACTORS for any non-pdurlej deployment, or move defaults to a config file

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `676` - Commit: `d635d5874c67df2c7515ea9ae28afad9fe64b916` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `control-plane/platformctl/apply.py` - Evidence: `control-plane/platformctl/apply.py` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`low`** Hardcoded default allowed actors are deployment-specific - Evidence: `control-plane/platformctl/apply.py line 50: DEFAULT_APPLY_ALLOWED_ACTORS = ("pdurlej", "pd", "Piotr") — these are personal usernames, not role-based identifiers` - Next: Consider documenting that DEFAULT_APPLY_ALLOWED_ACTORS must be overridden via PLATFORMCTL_APPLY_ALLOWED_ACTORS for any non-pdurlej deployment, or move defaults to a config file ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.